CEF is an open logging standard. PingFederate provides an option of writing elements from the audit log, the provisioner audit log, or both at runtime to a syslog receiver for parsing and analysis using ArcSight from Micro Focus. Alternatively, administrators can write the information to a flat file in CEF. However, you should use syslog when available.

Note:

PingFederate is tested with ArcSight for interoperability using the default elements defined in log4j2.xml. Any additions to these elements might render your CEF logging incompatible with ArcSight.